)]}'
{"id":"openstack%2Fswift~994451","triplet_id":"openstack%2Fswift~stable%2F2025.2~I84b0b6878f0baef025000d047aa705ad241a3a13","project":"openstack/swift","branch":"stable/2025.2","attention_set":{},"removed_from_attention_set":{"6968":{"account":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"last_update":"2026-06-23 20:01:55.000000000","reason":"Change was submitted"}},"hashtags":["CVE-2026-50221"],"change_id":"I84b0b6878f0baef025000d047aa705ad241a3a13","subject":"gatekeeper: Block X-Container-Host and other update headers from clients","status":"MERGED","created":"2026-06-23 15:00:49.000000000","updated":"2026-06-23 20:04:15.000000000","submitted":"2026-06-23 20:01:55.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":2,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"994451","meta_rev_id":"b3e24b4fdd3fcf57706ef6378239204919c892cc","_number":994451,"virtual_id_number":994451,"owner":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-06-23 20:01:55.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2026-06-23 15:21:17.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":1,"date":"2026-06-23 16:38:08.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-06-23 15:00:49.000000000","updated_by":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"reviewer":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"state":"CC"},{"updated":"2026-06-23 15:21:17.000000000","updated_by":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"reviewer":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"state":"REVIEWER"},{"updated":"2026-06-23 16:10:29.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"CC"},{"updated":"2026-06-23 16:15:10.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"04b3aabcfd164c1e323b374cdb3bf6522f12c01c","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"date":"2026-06-23 15:00:49.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"4b981ce6c0da2e78086b9fd319e1f2270e6aaac4","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-06-23 15:09:53.000000000","message":"Hashtag added: CVE-2026-50221","accounts_in_message":[],"_revision_number":1},{"id":"e67f0608d5afe5e339fe6d5aa4253df4ef2a95e7","author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"date":"2026-06-23 15:21:17.000000000","message":"Patch Set 1: Code-Review+2\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"fc43e69d796cd498e08063ad614176982a387f46","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-23 16:10:29.000000000","message":"Patch Set 1:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/c505cd7d448d485f89d47c0ce9e1b4c6\n\n- swift-tox-py312-arm64 https://zuul.opendev.org/t/openstack/build/7abde066f2884c7e80ffd0bcf046c316 : SUCCESS in 1h 06m 34s","accounts_in_message":[],"_revision_number":1},{"id":"7b7372417ab01bc9685a5b728ef57a5b4c512a7d","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-23 16:15:10.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/3f228b67108c4cabae682f7a6a1c8483\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/30c9f10dd2ee4d97bca2727616418a17 : SUCCESS in 10m 58s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/9dff7e9817274d83bae87ce3073b0360 : SUCCESS in 8m 42s\n- grenade https://zuul.opendev.org/t/openstack/build/47051816e5f9479e9394dfb79dbf4cd5 : SUCCESS in 1h 02m 37s\n- tempest-integrated-object-storage https://zuul.opendev.org/t/openstack/build/3ea1d8dce88f4215a78962de7b18ad00 : SUCCESS in 53m 42s\n- openstacksdk-functional-devstack https://zuul.opendev.org/t/openstack/build/32a7c74837304f32bff0a215f80224d1 : SUCCESS in 1h 02m 13s\n- swift-tox-func-py39-centos-9-stream-fips https://zuul.opendev.org/t/openstack/build/5fb4e8e78e094560a0a6bd19f0316a1b : SUCCESS in 20m 14s (non-voting)\n- swift-tox-func-encryption-py39-centos-9-stream-fips https://zuul.opendev.org/t/openstack/build/dfb557dd174b4db3b53573e3ad9d4d73 : SUCCESS in 20m 25s (non-voting)\n- swift-tox-func-ec-py39-centos-9-stream-fips https://zuul.opendev.org/t/openstack/build/49fe6d6b523241818f160ff6a635e6e1 : SUCCESS in 21m 35s (non-voting)\n- swift-build-image https://zuul.opendev.org/t/openstack/build/e040212d2ff544c0a11f02c31d552358 : SUCCESS in 6m 23s (non-voting)\n- swift-tox-py37 https://zuul.opendev.org/t/openstack/build/9082a579e59142b68abc783f5dc59619 : SUCCESS in 27m 24s\n- swift-tox-py39 https://zuul.opendev.org/t/openstack/build/d434795115294226ba6d6bd346c6ff4d : SUCCESS in 18m 01s\n- swift-tox-py312 https://zuul.opendev.org/t/openstack/build/c3b24746832d41289d94e08dfb77dc30 : SUCCESS in 30m 51s\n- swift-tox-py313 https://zuul.opendev.org/t/openstack/build/793ee0bf49364304887b0ef4dfd6d96b : SUCCESS in 28m 40s\n- swift-tox-func-py312 https://zuul.opendev.org/t/openstack/build/e3911742f5cc441ab863670c2fd04a8c : SUCCESS in 14m 54s\n- swift-tox-func-encryption-py312 https://zuul.opendev.org/t/openstack/build/2401f91326fb408bba76ac45ef838c41 : SUCCESS in 13m 30s\n- swift-tox-func-ec-py312 https://zuul.opendev.org/t/openstack/build/84183068aed54c0baee9a86afd738d60 : SUCCESS in 9m 17s\n- swift-func-cors https://zuul.opendev.org/t/openstack/build/d58b05a3cc2e46ada9c5bad63629d20a : SUCCESS in 6m 28s\n- swift-tox-func-ceph-s3tests-tempauth https://zuul.opendev.org/t/openstack/build/95332d93ac144dd5a5f52e4797d0fb03 : SUCCESS in 22m 39s (non-voting)\n- swift-tox-func-s3api-compat-tests-tempauth https://zuul.opendev.org/t/openstack/build/670bd259ddff4e72b1a5cb28651d66b7 : SUCCESS in 12m 16s\n- swift-probetests-centos-9-stream https://zuul.opendev.org/t/openstack/build/0d9722f55dbb45debd1e1d10180a080b : SUCCESS in 1h 06m 42s\n- swift-dsvm-functional https://zuul.opendev.org/t/openstack/build/1ae3446ec87d4803b16e555699f9c681 : SUCCESS in 53m 55s\n- swift-dsvm-functional-ipv6 https://zuul.opendev.org/t/openstack/build/6f075200cf314b278a9b5f4c1571756c : SUCCESS in 51m 00s\n- swift-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/630dda37f29042fd89a71e0edea03d52 : SUCCESS in 21m 10s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/3bdc68eaed43498bad033adf24f4fd8f : SUCCESS in 4m 41s\n- swift-multinode-rolling-upgrade https://zuul.opendev.org/t/openstack/build/84aec0852477493d82330a605f0f0146 : SUCCESS in 17m 33s\n- tempest-integrated-object-storage-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/b18b6475cb564bca9d2237ec233623f6 : SUCCESS in 54m 22s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/5c1cc6bca4f34dd080574a8835644a26 : SUCCESS in 58m 01s","accounts_in_message":[],"_revision_number":1},{"id":"41b5e650d18383210c59ecd3ee9437304a095c99","author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"date":"2026-06-23 16:38:08.000000000","message":"Patch Set 1: Workflow+1\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"5a3e9797461b95671d255ba4e68f90d413951be4","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-23 16:39:53.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"2e66fcc8b96a94b890e5a5635753daebe01702b7","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-23 20:01:55.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/6f53da84a16c4df894f99c859d210e94\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/9cd58b6c120e4192930f15888a0cc4b6 : SUCCESS in 7m 04s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/1bc550dfc2e1411384f9f9e95bf93f6d : SUCCESS in 4m 32s\n- grenade https://zuul.opendev.org/t/openstack/build/c983db55fe3c4617adea85a85e2c03e7 : SUCCESS in 1h 07m 13s\n- tempest-integrated-object-storage https://zuul.opendev.org/t/openstack/build/83f4de28ec464af181647fd1ecf9c1ac : SUCCESS in 52m 15s\n- openstacksdk-functional-devstack https://zuul.opendev.org/t/openstack/build/4006c7218ce44735bf51f6ec8a435c53 : SUCCESS in 52m 28s\n- swift-upload-image https://zuul.opendev.org/t/openstack/build/ea91881e1f4945cab224294beb58abf8 : RETRY_LIMIT in 33s (non-voting)\n- swift-tox-py37 https://zuul.opendev.org/t/openstack/build/ec7d2750d2e04e44b10280400e1b1116 : SUCCESS in 24m 10s\n- swift-tox-py39 https://zuul.opendev.org/t/openstack/build/43fa510c852f46aea728bf3fce4d4103 : SUCCESS in 21m 07s\n- swift-tox-py312 https://zuul.opendev.org/t/openstack/build/f6efdcd4c28e482f8c09e4581d5299c7 : SUCCESS in 12m 22s\n- swift-tox-py313 https://zuul.opendev.org/t/openstack/build/2ad11e09f17f4fba815a3de8780e94c3 : SUCCESS in 27m 53s\n- swift-tox-func-py312 https://zuul.opendev.org/t/openstack/build/bb37419dcd974d0d9a5e9b82be5d98e3 : SUCCESS in 16m 18s\n- swift-tox-func-encryption-py312 https://zuul.opendev.org/t/openstack/build/db831c893b9d466dad6947a8c63d8675 : SUCCESS in 19m 28s\n- swift-tox-func-ec-py312 https://zuul.opendev.org/t/openstack/build/680cd7e92c204b19bf770b475cfeaced : SUCCESS in 17m 28s\n- swift-func-cors https://zuul.opendev.org/t/openstack/build/61f0288fa38f4be9a15514ebe6a41415 : SUCCESS in 16m 48s\n- swift-tox-func-s3api-compat-tests-tempauth https://zuul.opendev.org/t/openstack/build/600b7dd0817b49bab54ad7a1fecbf2be : SUCCESS in 10m 06s\n- swift-probetests-centos-9-stream https://zuul.opendev.org/t/openstack/build/434433caaed14b99873ad68f7dd392b0 : SUCCESS in 57m 51s\n- swift-dsvm-functional https://zuul.opendev.org/t/openstack/build/abd83762627c4db6be10a6c25cfa5dab : SUCCESS in 46m 09s\n- swift-dsvm-functional-ipv6 https://zuul.opendev.org/t/openstack/build/e2851bd7dc6d4fddbb5b071c44bbaf78 : SUCCESS in 57m 00s\n- swift-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/8e5674abd2944d65b1e39b92b6179613 : SUCCESS in 29m 26s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/67b2e476ab7e48708b6982154f63510a : SUCCESS in 3m 24s\n- swift-multinode-rolling-upgrade https://zuul.opendev.org/t/openstack/build/43a5f91f516c40f0b487bb4b3a48a4b5 : SUCCESS in 21m 32s\n- tempest-integrated-object-storage-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/359c618e2f7648c78dfc20d0c0b2f553 : SUCCESS in 53m 33s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/b1d19e08f6594ada878f3fc640d3adb5 : SUCCESS in 1h 00m 23s","accounts_in_message":[],"_revision_number":1},{"id":"94484cf8470b5474b583247b126eb17b0e8d5401","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-23 20:01:55.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":1},{"id":"b3e24b4fdd3fcf57706ef6378239204919c892cc","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-23 20:04:15.000000000","message":"Patch Set 1:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/5c2135e2d728461f8320d96f860cbfe2\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/14c891a624004eb28433492a151b0a47 : SUCCESS in 1m 02s\n- swift-promote-image https://zuul.opendev.org/t/openstack/build/865c5984d0e742c08e877d0612fa940b : RETRY_LIMIT in 6s (non-voting)","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"f8c92d5027229796162f79893d5b117f440661ec","revisions":{"f8c92d5027229796162f79893d5b117f440661ec":{"kind":"REWORK","_number":1,"created":"2026-06-23 15:00:49.000000000","uploader":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"ref":"refs/changes/51/994451/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/swift","ref":"refs/changes/51/994451/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/swift refs/changes/51/994451/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/swift refs/changes/51/994451/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/swift refs/changes/51/994451/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/swift refs/changes/51/994451/1"}}},"commit":{"parents":[{"commit":"f641504be4af8b3375df688a0ae1bad6eeca0f32","subject":"[stable-only] Pin version of tempest","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/f641504be4af8b3375df688a0ae1bad6eeca0f32"}]}],"author":{"name":"Tim Burke","email":"tim.burke@gmail.com","date":"2026-05-12 21:57:34.000000000","tz":-420},"committer":{"name":"Christian Schwede","email":"cschwede@mailbox.org","date":"2026-06-23 14:54:47.000000000","tz":120},"subject":"gatekeeper: Block X-Container-Host and other update headers from clients","message":"gatekeeper: Block X-Container-Host and other update headers from clients\n\nThere are a variety of headers that get used by object-servers to\nupdate container-servers or by container-servers to update\naccount-servers. None of them start with X-Backend- (they predated that\nnamespace), and previously were not blocked by the gatekeeper. As a\nresult, a malicious client could direct the object-server to send\nupdates to unintended locations.\n\nNow, block all update-related X-Account-*, X-Container-*, and\nX-Delete-At-* headers at the gatekeeper.\n\nFixes: CVE-2026-50221\nCloses-Bug: #2150261\nChange-Id: I84b0b6878f0baef025000d047aa705ad241a3a13\nSigned-off-by: Tim Burke \u003ctim.burke@gmail.com\u003e\nSigned-off-by: Christian Schwede \u003ccschwede@mailbox.org\u003e\n(cherry picked from commit 75b050fdb1d1a6096f3765faa3b2059e28065d13)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/f8c92d5027229796162f79893d5b117f440661ec"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/f8c92d5027229796162f79893d5b117f440661ec"}]},"branch":"refs/heads/stable/2025.2"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}